ha: add Frigate NVR as a Podman Quadlet, wire into deploy.sh

Same sibling-container pattern as HA/ESPHome. The hand-written unit used
Privileged=true, which isn't a real Quadlet key — the generator silently
drops the whole file on an unsupported key, so frigate.service was never
generated (hence `systemctl enable frigate` saying the unit doesn't exist).
Fixed with PodmanArgs=--privileged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

ha/frigate.container

@@ -0,0 +1,43 @@
+# Frigate NVR as a Podman Quadlet, same pattern as homeassistant.container /
+# esphome.container. Installed by deploy.sh to /etc/containers/systemd/;
+# systemd generates frigate.service from it. Note: "Privileged=true" is NOT a
+# real Quadlet key — the generator silently skips the whole file if you use
+# it (no frigate.service is generated at all, so `systemctl enable frigate`
+# fails with "Unit frigate.service does not exist"). Use PodmanArgs=--privileged.
+#
+# Host networking: dashboard/API bind :5000, go2rtc webrtc on :8971.
+# Config (/srv/frigate/config/config.yml) and recordings (/srv/frigate/storage)
+# are host state, not shipped by deploy.sh — same as /srv/homeassistant.
+[Unit]
+Description=Frigate NVR (Podman container)
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+Image=ghcr.io/blakeblackshear/frigate:stable
+ContainerName=frigate
+Network=host
+Volume=/srv/frigate/config:/config
+Volume=/srv/frigate/storage:/media/frigate
+Volume=/etc/localtime:/etc/localtime:ro
+Environment=TZ=America/Toronto
+
+PublishPort=5000:5000
+PublishPort=8971:8971
+
+# FFmpeg video buffers need more than the 64m Podman default.
+ShmSize=64m
+
+# Privileged (not just AddCapability) for full /dev access to camera/GPU
+# devices without hand-enumerating every /dev/videoN node.
+PodmanArgs=--privileged
+GroupAdd=keep-groups
+AddCapability=CAP_PERFMON
+
+[Service]
+Restart=always
+# First start pulls the image; allow for a slow uplink.
+TimeoutStartSec=900
+
+[Install]
+WantedBy=multi-user.target